Contour vs Traefik Proxy

Contour is a free, self-hosted, open-source Kubernetes ingress controller that provides the control plane for the Envoy edge and service proxy. It supports Kubernetes Ingress v1, its HTTPProxy custom resource and Gateway API. Contour updates ingress configuration dynamically with minimal dropped connections and supports multiple configuration types in clusters used by multiple teams. It can run as a Kubernetes deployment or daemonset, and administrators can delegate access to wildcard certificates. Documented security features include TLS termination, client authorization, rate limiting, JWT verification and IP filtering. Contour and Envoy expose metrics that Prometheus can scrape, and documentation includes guides for cert-manager, Gatekeeper and AWS Network Load Balancer. The project is tested with Kubernetes 1.21 and later and is intended for both cluster administrators and application developers. Community support is available through the project's GitHub page, where users can report issues or ask questions. Contour is a Cloud Native Computing Foundation incubating project; its documentation includes a threat model, a security reporting process and a security fix checklist.

Traefik Proxy is a free, open-source reverse proxy and ingress controller for deploying services and APIs. It discovers services and adjusts routing dynamically, supporting HTTP, HTTP/2, HTTP/3, TCP, UDP, WebSockets, and gRPC. Traffic controls include Layer 4 and Layer 7 routing, mirroring, blue-green and canary deployments, stickiness, and active health checks. Security options include automatic HTTPS, Let’s Encrypt, custom certificates, authentication, and Web Application Firewall support. Integrations span Kubernetes, Docker, Docker Swarm, Red Hat OpenShift, Rancher, Amazon ECS, Consul, and key-value stores. It supports deployment on environments including Kubernetes distributions, virtual machines, bare metal, Docker Swarm, and HashiCorp Nomad. Observability includes OpenTelemetry, a built-in dashboard, distributed tracing, and metrics integrations. WebAssembly plugins and a public plugin catalog provide extension options. Traefik Proxy is self-hosted and listed for Linux, macOS, and Windows. The plan is free; Traefik Labs also offers commercial support with expert assistance available 24/7/365.